CH 05

Fundamentals of Information
Systems Security
Lesson 5
Access Controls
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com
All rights reserved.
Learning Objective(s)
 Explain the role of access controls in an IT
infrastructure.

Fundamentals of Information Systems Security www.jblearning.com Page 2
Key Concepts
 Access control concepts and technologies
 Formal models of access control
 How identity is managed by access control
 Developing and maintaining system access
controls

Defining Access Control
 The process of protecting a resource so
that it is used only by those allowed to
 Prevents unauthorized use
 Mitigations put into place to protect a
resource from a threat

Four Parts of Access Control
Access Control
Component Description
Identification Who is asking to access the
asset?
Authentication Can their identities be verified?
Authorization What, exactly, can the requestor

access? And what can they do?
Accountability How are actions traced to an
individual to ensure the person
who makes data or system
changes can be identified?
Policy Definition and Policy
Enforcement Phases
 Policy definition phase—Who has access
and what systems or resources they can use
• Tied to the authorization phase
 Policy enforcement phase—Grants or
rejects requests for access based on the
authorizations defined in the first phase
• Tied to identification, authentication, and
accountability phases

Two Types of Access Controls
•Controls entry into

Physical buildings, parking lots,
and protected areas
•Controls access to a
Logical computer system or
network

Physical Access Control
 Smart cards are an example
 Programmed with ID number
 Used at parking lots, elevators, office doors
 Shared office buildings may require an
additional after hours card
 Cards control access to physical resources

Logical Access Control
 Deciding which users can get into a system
 Monitoring what each user does on that
system
 Restraining or influencing a user’s behavior
on that system

The Security Kernel
 Enforces access control for computer
systems
 Central point of access control
 Implements the reference monitor concept

Enforcing Access Control

Access Control Policies
Four central components of access control:
•People who use the system or
Users processes (subjects)
Resources •Protected objects in the system
•Activities that authorized users

Actions can perform on resources
•Optional conditions that exist

Relationships between users and resources

Logical Access Control Solutions
Logical Controls Solutions
Biometrics • Static: Fingerprints, iris granularity, retina blood
vessels, facial features, and hand geometry
• Dynamic: Voice inflections, keyboard strokes, and
signature motions
Tokens • Synchronous or asynchronous
• Smart cards and memory cards
Passwords • Stringent password controls for users

• Account lockout policies
• Auditing logon events
Single sign-on • Kerberos process

• Secure European System for Applications in a
Multi-Vendor Environment (SESAME)

Authorization Policies
Group
Authority-level
Authorization membership
policy
policy
User-
assigned
privileges

Methods and Guidelines for
Identification
• Username
Methods • Smart card
• Biometrics
• Actions
Guidelines
• Accounting

Authentication Types
Knowledge Something you know
Ownership • Something you have
Characteristics • Something unique to you
Location • Somewhere you are
• Something you do/how you do

Action
it

Authentication by Knowledge
 Password
• Weak passwords easily cracked by brute-force
or dictionary attack
• Password best practices
 Passphrase
• Stronger than a password
 Account lockout policies
 Audit logon events

Authentication by Ownership
 Synchronous token—Calculates a number at
both the authentication server and the device
• Time-based synchronization system
• Event-based synchronization system
• Continuous authentication
 Asynchronous token
• USB token
• Smart card
• Memory cards (magnetic stripe)

Asynchronous Token Challenge-
Response

Authentication by
Characteristics/Biometrics
Static Dynamic
(physiological) (behavioral)
measures measures
What you
What you do
are

Concerns Surrounding Biometrics
•Accuracy
Reaction
Acceptability
time

Types of Biometrics
Facial Voice
Fingerprint recognition pattern
Keystroke
Palm print Iris scan
dynamics
Hand Signature
Retina scan
geometry dynamics

Authentication by Location and
Action
 Location
• Strong indicator of authenticity
• Additional information to suggest granting
or denying access to a resource
 Action
• Stores the patterns or nuances of how you
do something
• Record typing patterns

Single Sign-On (SSO)
 Sign on to a computer or network once
 Identification and authorization credentials
allow user to access all computers and
systems where authorized
 Reduces human error
 Difficult to put in place

SSO Processes
Kerberos
Secure European System for Applications in

a Multi-Vendor Environment (SESAME)
Lightweight Directory Access Protocol

(LDAP)

Policies and Procedures for
Accountability
Log files
Monitoring and reviews
Data retention
Media disposal
Compliance requirements

Formal Models of Access Control
Discretionary access control (DAC)
Mandatory access control (MAC)
Nondiscretionary access control
Rule-based access control

Discretionary Access Control
 Operating systems-based DAC policy
considerations
• Access control method
• New user registration
• Periodic review
 Application-based DAC
 Permission levels

Mandatory Access Control
 Determine the level of restriction by how
sensitive the resource is (classification
label)
 System and owner make the decision to
allow access
 Temporal isolation/time-of-day restrictions
 MAC is stronger than DAC

Nondiscretionary Access Control
 Access rules are closely managed by security
administrator, not system owner or ordinary
users
 Sensitive files are write-protected for integrity
and readable only by authorized users
 More secure than discretionary access control
 Ensures that system security is enforced and
tamperproof

Rule-Based Access Control

Access Control Lists
Linux and OS X
Permissions • Read, write, execute
Applied to • File owners, groups, global users

Access Control Lists (cont.)
Windows
Share permissions •Full, change, read, deny
•Full, modify, list folder contents,

Security
read-execute, read, write,
permissions
special, deny

An Access Control List

Role-Based Access Control

Content-Dependent Access Control

Constrained User Interface
Methods of constraining users
Physically
Database constrained
Menus Encryption
views user
interfaces

Other Access Control Models
Bell-LaPadula model
Biba integrity model
Clark and Wilson integrity model
Brewer and Nash integrity model

Brewer and Nash Integrity Model

Effects of Breaches in Access
Control
Disclosure of private information
Corruption of data
Loss of business intelligence
Danger to facilities, staff, and systems
Damage to equipment
Failure of systems and business processes

Threats to Access Controls
 Gaining physical access
 Eavesdropping by observation
 Bypassing security
 Exploiting hardware and software
 Reusing or discarding media
 Electronic eavesdropping
 Intercepting communication
 Accessing networks
 Exploiting applications
Effects of Access Control Violations
Loss of customer confidence

Loss of business opportunities
New regulations imposed on the organization
Bad publicity
More oversight
Financial penalties

Credential and Permissions
Management
 Systems that provide the ability to collect,
manage, and use the information
associated with access control
 Microsoft offers Group Policy and Group
Policy Objects (GPOs) to help
administrators manage access controls

Centralized and Decentralized
Access Control
 Centralized authentication, authorization, and
accounting (AAA) servers
• RADIUS: Most popular; two configuration files
• TACACS+: Internet Engineering Task Force (IETF)
standard; one configuration file
• DIAMETER: Base protocol and extensions
• SAML: Open standard based on XML for exchanging
both authentication and authorization data

Decentralized Access Control
 Access control is in the hands of the people
closest to the system users
 Password Authentication Protocol (PAP)
 Challenge-Handshake Authentication Protocol
(CHAP)
 Mobile device authentication, Initiative for Open
Authentication (OATH)
• HMAC-based one-time password (HOTP)
• Time-based one-time password (TOTP)

Privacy
 Communicate expectations for privacy in acceptable
use policies (AUPs) and logon banners
 Monitoring in the workplace includes:
• Opening mail or email
• Using automated software to check email
• Checking phone logs or recording phone calls
• Checking logs of web sites visited
• Getting information from credit-reference agencies
• Collecting information through point-of-sale (PoS)
terminals
• Recording activities on closed-circuit television (CCTV)

Cloud Computing
Category Description
Private All components are managed for a single
organization. May be managed by the organization
or by a third-party provider.
Community Components are shared by several organizations
and managed by one of the participating
organizations or by a third party.
Public Available for public use and managed by third-party

providers.
Hybrid Contains components of more than one type of
cloud, including private, community, and public
clouds.

Advantages/Disadvantages of
Cloud Computing
Advantages Disadvantages
 No need to maintain a  More difficult to keep
data center private data secure
 No need to maintain a  Greater danger of
disaster recovery site private data leakage
 Outsourced  Demand for constant
responsibility for network access
performance and  Client needs to trust the
connectivity outside vendor
 On-demand provisioning

Summary
 Access control concepts and technologies
 Formal models of access control
 How identity is managed by access control
 Developing and maintaining system access
controls


CH 05

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CH 05

Uploaded by

Copyright:

Available Formats

Fundamentals of Information

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Authorization What, exactly, can the requestor

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

•Controls entry into

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Resources •Protected objects in the system

•Activities that authorized users

•Optional conditions that exist

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Passwords • Stringent password controls for users

Single sign-on • Kerberos process

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Ownership • Something you have

Characteristics • Something unique to you

Location • Somewhere you are

• Something you do/how you do

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Secure European System for Applications in

Lightweight Directory Access Protocol

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Discretionary access control (DAC)

Mandatory access control (MAC)

Nondiscretionary access control

Rule-based access control

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Permissions • Read, write, execute

Applied to • File owners, groups, global users

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Share permissions •Full, change, read, deny

•Full, modify, list folder contents,

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Methods of constraining users

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Biba integrity model

Clark and Wilson integrity model

Brewer and Nash integrity model

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company